Bad actors are abusing large, open-registration, low-moderation Mastodon instances in order to provide direction to the Vidar Stealer trojan horse, which steals passwords, credit card details, bitcoin wallets, etc.
If you run a large, open-registration, low-moderation instance, please consider changing at least one of those qualities.
@noelle How is anyone supposed to find these *unless* you follow the trail from the malware itself? Seems a bit unfair to blame Mastodon servers here
@Sandrockcstm It's more like, people want you to find when someone signs up for your e-mail server and coordinates malware attacks by having his malware connect to the smtp server and read something from an e-mail draft that never gets sent somewhere. We're not talking about refusing to ban someone after they get reported for this.
Except we are?
"The idea is to secure communications from the compromised machine to the configuration source, and since Mastodon is a trusted platform, it shouldn’t raise any red flags with security tools. At the same time, Mastodon a relatively under-moderated space so these malicious profiles are unlikely to be spotted, reported, and removed."
The entire reason this works is that Mastodon is considered trusted and often unmoderated. That's the only way this attack works.
Server run by the main developers of the project It is not focused on any particular niche interest - everyone is welcome as long as you follow our code of conduct!